Python-сообщество

from django.utils.html import escape
cd['message'] = escape(cd['message'])

@register.filter
def bbcode(value):

    bbdata = [
        (r'\[url=(.+?)\](.+?)\[/url\]', r'<a href="\1">\2</a>'),
        (r'\[b\](.+?)\[/b\]', r'<b>\1</b>'),
        (r'\[i\](.+?)\[/i\]', r'<i>\1</i>'),
        (r'\[u\](.+?)\[/u\]', r'<u>\1</u>'),
        (r'\[quote\](.+?)\[/quote\]', r'<div style="margin-left: 1cm">\1</div>'),
        (r'\[code\](.+?)\[/code\]', r'<pre>\1</pre>'),
        ]

    for bbset in bbdata:
        p = re.compile(bbset[0], re.DOTALL)
        value = p.sub(bbset[1], value)

    return value

{{ comment.text|bbcode|safe|linebreaks }}

[url=javascript:alert(String.fromCharCode(88,83,83))]http://google.com[/url]